Vulnerability-Lookup

CVE-2026-21589 (GCVE-0-2026-21589)

Vulnerability from cvelistv5 – Published: 2026-10-05 21:30 – Updated: 2026-10-19 18:26

CISA Shadowserver Previdian

Summary

This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior knowledge of the target file's exact name and path; this vulnerability does not allow attackers to enumerate or list directory contents. In some configurations, there may be some sensitive files that make this highly severe. This vulnerability allows an unauthenticated remote attacker to access specific files within the web application root directory in affected versions. The vulnerability must be addressed for affected versions of: -- Bitbucket Data Center, introduced in version >= 4.6.0, fix versions: 9.4.26, 10.2.8, 10.5.1 -- Confluence Data Center, introduced in version >= 5.10.0, fix versions 9.2.26, 10.2.19 -- Crowd Data Center, introduced in version >= 2.11.0, fix versions 6.3.7, 7.0.3, 7.1.7, 7.2.4 -- Jira Software Data Center, introduced in version >= 7.1.0, fix versions 9.12.40, 10.3.26, 11.3.12 -- Jira Service Management Data Center, introduced in version >= 3.1.0, fix versions 5.12.40, 10.3.26, 11.3.12 -- Bamboo Data Center >= 7.0.1, fix versions 10.2.24, 12.1.12 -- Crucible, fix versions 4.9.15 -- Fisheye, fix version 4.9.15 -- Exploitation requires prior knowledge of the target file's exact name and path. The vulnerability does not include the capability to enumerate or list directory contents.

Severity

9.3 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H

SSVC

Exploitation: active Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-15 00:00 UTC

CWE

Path Traversal (Arbitrary Read/Write)
CWE-552 - Files or Directories Accessible to External Parties

Assigner

atlassian CNA under the mitre root

CNA scorecard C 61/100 over 10 records in the last 180 days details

References

10 references

URL	Tags
https://jira.atlassian.com/browse/BAM-26567
https://jira.atlassian.com/browse/BSERV-20604
https://jira.atlassian.com/browse/CONFSERVER-104488
https://jira.atlassian.com/browse/CRUC-8741
https://jira.atlassian.com/browse/CWD-6610
https://jira.atlassian.com/browse/FE-7583
https://jira.atlassian.com/browse/JRASERVER-79546
https://jira.atlassian.com/browse/JSDSERVER-16809
https://github.com/watchtowrlabs/watchTowr-vs-Atl…	exploit
https://www.cisa.gov/known-exploited-vulnerabilit…	government-resource

Impacted products

8 products

Vendor	Product	Version	CPE status
Atlassian	Bamboo Data Center	Affected: All other versions Unaffected: Patch version 10.2.24 and later Unaffected: Patch version 12.1.12 and later	guessed
Atlassian	Bitbucket Data Center	Affected: All other versions Unaffected: Patch version 10.2.8 and later Unaffected: Patch version 10.5.1 and later Unaffected: Patch version 9.4.26 and later	guessed
Atlassian	Confluence Data Center	Affected: All other versions Unaffected: Patch version 10.2.19 and later Unaffected: Patch version 9.2.26 and later	guessed
Atlassian	Crowd Data Center	Affected: All other versions Unaffected: Patch version 7.2.4 and later Unaffected: Patch version 7.1.7 and later Unaffected: Patch version 7.0.3 and later Unaffected: Patch version 6.3.7 and later	guessed
Atlassian	Crucible Data Center	Affected: All other versions Unaffected: Patch version 4.9.15 and later	guessed
Atlassian	Fisheye Data Center	Affected: All other versions Unaffected: Patch version 4.9.15 and later	guessed
Atlassian	Jira Service Management Data Center	Affected: All other versions Unaffected: Patch version 11.3.12 and later Unaffected: Patch version 10.3.26 and later Unaffected: Patch version 5.12.40 and later	guessed
Atlassian	Jira Software Data Center	Affected: All other versions Unaffected: Patch version 11.3.12 and later Unaffected: Patch version 10.3.26 and later Unaffected: Patch version 9.12.40 and later	guessed

CISA

Known Exploited Vulnerability - GCVE BCP-07 Compliant

KEV entry ID: cee62cbf-91d9-4d0d-81b9-75fb8b4e8794

Vulnerability ID: CVE-2026-21589

Status: Confirmed

Status Updated: 2026-10-15 00:00 UTC

Exploited: Yes

Timestamps

First Seen: 2026-10-15

Asserted: 2026-10-15

Scope

Notes: Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability | Affected: Atlassian / Multiple Products | Description: Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye) contain a files or directories accessible to external parties vulnerability which could allow an unauthenticated attacker to access specific files within the web application root directory in affected versions. | Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. | Due date: 2026-10-18 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://confluence.atlassian.com/security/cve-2026-21589-arbitrary-file-access-vulnerability-impacts-multiple-products-1870495748.html?ref=labs.watchtowr.com ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-21589

Evidence

Type: Vendor Report

Signal: Successful Exploitation

Confidence: 80%

Source: cisa-kev

Details

Cwes	CWE-552
Feed	CISA Known Exploited Vulnerabilities Catalog
Product	Multiple Products
Due Date	2026-10-18
Date Added	2026-10-15
Vendorproject	Atlassian
Vulnerabilityname	Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability
Knownransomwarecampaignuse	Unknown

References

CVE-2026-21589

Created: 2026-10-15 18:00 UTC | Updated: 2026-10-15 18:00 UTC

Shadowserver

Known Exploited Vulnerability - GCVE BCP-07 Compliant

KEV entry ID: 134c15ae-26e6-4152-beb2-0d923ff41c41

Vulnerability ID: CVE-2026-21589

Status: Confirmed

Status Updated: 2026-10-26 00:00 UTC

Exploited: Yes

Characteristics

Severity: 98.0

Timestamps

First Seen: 2026-10-14

Asserted: 2026-10-14

Last Seen: 2026-10-26

Scope

Asset Exposure: ['internet-facing']

Evidence

Type: Honeypot

Signal: In The Wild Attempts

Confidence: 70%

Source: shadowserver

Details

1D	2
Iot	no
Feed	Shadowserver Foundation honeypot/exploited-vulnerabilities
Type	http-scan
Class	other-software
7D Avg	8
Vendor	Atlassian
30D Avg	5
90D Avg	1
Product	Confluence
Cisa Kev	yes
Connections	8
Observation Date	2026-10-26
Vulnerability Class	CVSS
Vulnerability Score	9.8
Vulnerability Severity	Critical

References

Created: 2026-10-21 09:13 UTC | Updated: 2026-10-28 01:00 UTC

Previdian

Known Exploited Vulnerability - GCVE BCP-07 Compliant

KEV entry ID: 7d8466e1-160a-4628-b997-76969e247158

Vulnerability ID: CVE-2026-21589

Status: Confirmed

Status Updated: 2026-10-06 21:55 UTC

Exploited: Yes

Timestamps

First Seen: 2026-10-06

Asserted: 2026-10-06

Scope

Notes: This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo... | Affected: Atlassian / Bamboo Data Center, Bitbucket Data Center, Confluence Data Center, Crowd Data Center, Crucible Data Center, Fisheye Data Center, Jira Service Management Data Center, Jira Software Data Center | CVSS: 9.3 (CRITICAL) | EPSS: 0.00738 | Used in malware: unknown | Not yet in CISA KEV: True

Evidence

Type: Public Report

Signal: Successful Exploitation

Confidence: 70%

Source: previdian

Details

Feed	Previdian (previdian.com)
Title	This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo...
Cve Id	CVE-2026-21589
Vendor	Atlassian
Ghsa Id	None
Product	Bamboo Data Center, Bitbucket Data Center, Confluence Data Center, Crowd Data Center, Crucible Data Center, Fisheye Data Center, Jira Service Management Data Center, Jira Software Data Center
Added Date	2026-10-06T21:55:50.336Z
Cvss Score	9.3
Epss Score	0.00738
Previous Ids
Cvss Severity	CRITICAL
Virtual Patch	True
Cvss Estimated	False
Epss Percentile	0.53045
Used In Malware	unknown
Vulnerability Id	CVE-2026-21589
Ahead Of Cisa Kev	None
Not Yet In Cisa Kev	True

References

Created: 2026-10-07 22:00 UTC | Updated: 2026-10-07 22:00 UTC

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-21589",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2026-10-15",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21589"
              },
              "type": "kev"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-552",
                "description": "CWE-552 Files or Directories Accessible to External Parties",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T03:56:40.891Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/watchtowrlabs/watchTowr-vs-Atlassian-CVE-2026-21589"
          },
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21589"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-10-15T00:00:00.000Z",
            "value": "CVE-2026-21589 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Bamboo Data Center",
          "vendor": "Atlassian",
          "versions": [
            {
              "status": "affected",
              "version": "All other versions"
            },
            {
              "status": "unaffected",
              "version": "Patch version 10.2.24 and later"
            },
            {
              "status": "unaffected",
              "version": "Patch version 12.1.12 and later"
            }
          ]
        },
        {
          "product": "Bitbucket Data Center",
          "vendor": "Atlassian",
          "versions": [
            {
              "status": "affected",
              "version": "All other versions"
            },
            {
              "status": "unaffected",
              "version": "Patch version 10.2.8 and later"
            },
            {
              "status": "unaffected",
              "version": "Patch version 10.5.1 and later"
            },
            {
              "status": "unaffected",
              "version": "Patch version 9.4.26 and later"
            }
          ]
        },
        {
          "product": "Confluence Data Center",
          "vendor": "Atlassian",
          "versions": [
            {
              "status": "affected",
              "version": "All other versions"
            },
            {
              "status": "unaffected",
              "version": "Patch version 10.2.19 and later"
            },
            {
              "status": "unaffected",
              "version": "Patch version 9.2.26 and later"
            }
          ]
        },
        {
          "product": "Crowd Data Center",
          "vendor": "Atlassian",
          "versions": [
            {
              "status": "affected",
              "version": "All other versions"
            },
            {
              "status": "unaffected",
              "version": "Patch version 7.2.4 and later"
            },
            {
              "status": "unaffected",
              "version": "Patch version 7.1.7 and later"
            },
            {
              "status": "unaffected",
              "version": "Patch version 7.0.3 and later"
            },
            {
              "status": "unaffected",
              "version": "Patch version 6.3.7 and later"
            }
          ]
        },
        {
          "product": "Crucible Data Center",
          "vendor": "Atlassian",
          "versions": [
            {
              "status": "affected",
              "version": "All other versions"
            },
            {
              "status": "unaffected",
              "version": "Patch version 4.9.15 and later"
            }
          ]
        },
        {
          "product": "Fisheye Data Center",
          "vendor": "Atlassian",
          "versions": [
            {
              "status": "affected",
              "version": "All other versions"
            },
            {
              "status": "unaffected",
              "version": "Patch version 4.9.15 and later"
            }
          ]
        },
        {
          "product": "Jira Service Management Data Center",
          "vendor": "Atlassian",
          "versions": [
            {
              "status": "affected",
              "version": "All other versions"
            },
            {
              "status": "unaffected",
              "version": "Patch version 11.3.12 and later"
            },
            {
              "status": "unaffected",
              "version": "Patch version 10.3.26 and later"
            },
            {
              "status": "unaffected",
              "version": "Patch version 5.12.40 and later"
            }
          ]
        },
        {
          "product": "Jira Software Data Center",
          "vendor": "Atlassian",
          "versions": [
            {
              "status": "affected",
              "version": "All other versions"
            },
            {
              "status": "unaffected",
              "version": "Patch version 11.3.12 and later"
            },
            {
              "status": "unaffected",
              "version": "Patch version 10.3.26 and later"
            },
            {
              "status": "unaffected",
              "version": "Patch version 9.12.40 and later"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior knowledge of the target file\u0027s exact name and path; this vulnerability does not allow attackers to enumerate or list directory contents. In some configurations, there may be some sensitive files that make this highly severe. This vulnerability allows an unauthenticated remote attacker to access specific files within the web application root directory in affected versions. The vulnerability must be addressed for affected versions of: -- Bitbucket Data Center, introduced in version \u003e= 4.6.0, fix versions: 9.4.26, 10.2.8, 10.5.1 -- Confluence Data Center, introduced in version \u003e= 5.10.0, fix versions 9.2.26, 10.2.19 -- Crowd Data Center, introduced in version \u003e= 2.11.0, fix versions 6.3.7, 7.0.3, 7.1.7, 7.2.4 -- Jira Software Data Center, introduced in version \u003e= 7.1.0, fix versions 9.12.40, 10.3.26, 11.3.12 -- Jira Service Management Data Center, introduced in version \u003e= 3.1.0, fix versions 5.12.40, 10.3.26, 11.3.12 -- Bamboo Data Center \u003e= 7.0.1, fix versions 10.2.24, 12.1.12 -- Crucible, fix versions 4.9.15 -- Fisheye, fix version 4.9.15 -- Exploitation requires prior knowledge of the target file\u0027s exact name and path. The vulnerability does not include the capability to enumerate or list directory contents."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H",
            "version": "4.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Path Traversal (Arbitrary Read/Write)",
              "lang": "en",
              "type": "Path Traversal (Arbitrary Read/Write)"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T18:26:40.891Z",
        "orgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66",
        "shortName": "atlassian"
      },
      "references": [
        {
          "url": "https://jira.atlassian.com/browse/BAM-26567"
        },
        {
          "url": "https://jira.atlassian.com/browse/BSERV-20604"
        },
        {
          "url": "https://jira.atlassian.com/browse/CONFSERVER-104488"
        },
        {
          "url": "https://jira.atlassian.com/browse/CRUC-8741"
        },
        {
          "url": "https://jira.atlassian.com/browse/CWD-6610"
        },
        {
          "url": "https://jira.atlassian.com/browse/FE-7583"
        },
        {
          "url": "https://jira.atlassian.com/browse/JRASERVER-79546"
        },
        {
          "url": "https://jira.atlassian.com/browse/JSDSERVER-16809"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66",
    "assignerShortName": "atlassian",
    "cveId": "CVE-2026-21589",
    "datePublished": "2026-10-05T21:30:00.390Z",
    "dateReserved": "2026-01-01T00:00:40.722Z",
    "dateUpdated": "2026-10-19T18:26:40.891Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-21589",
      "date": "2026-10-28",
      "epss": "0.99477",
      "percentile": "0.99943"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "Bamboo Data Center",
                "vendor": "Atlassian",
                "versions": [
                  {
                    "status": "affected",
                    "version": "All other versions"
                  },
                  {
                    "status": "unaffected",
                    "version": "Patch version 10.2.24 and later"
                  },
                  {
                    "status": "unaffected",
                    "version": "Patch version 12.1.12 and later"
                  }
                ]
              },
              {
                "product": "Bitbucket Data Center",
                "vendor": "Atlassian",
                "versions": [
                  {
                    "status": "affected",
                    "version": "All other versions"
                  },
                  {
                    "status": "unaffected",
                    "version": "Patch version 10.2.8 and later"
                  },
                  {
                    "status": "unaffected",
                    "version": "Patch version 10.5.1 and later"
                  },
                  {
                    "status": "unaffected",
                    "version": "Patch version 9.4.26 and later"
                  }
                ]
              },
              {
                "product": "Confluence Data Center",
                "vendor": "Atlassian",
                "versions": [
                  {
                    "status": "affected",
                    "version": "All other versions"
                  },
                  {
                    "status": "unaffected",
                    "version": "Patch version 10.2.19 and later"
                  },
                  {
                    "status": "unaffected",
                    "version": "Patch version 9.2.26 and later"
                  }
                ]
              },
              {
                "product": "Crowd Data Center",
                "vendor": "Atlassian",
                "versions": [
                  {
                    "status": "affected",
                    "version": "All other versions"
                  },
                  {
                    "status": "unaffected",
                    "version": "Patch version 7.2.4 and later"
                  },
                  {
                    "status": "unaffected",
                    "version": "Patch version 7.1.7 and later"
                  },
                  {
                    "status": "unaffected",
                    "version": "Patch version 7.0.3 and later"
                  },
                  {
                    "status": "unaffected",
                    "version": "Patch version 6.3.7 and later"
                  }
                ]
              },
              {
                "product": "Crucible Data Center",
                "vendor": "Atlassian",
                "versions": [
                  {
                    "status": "affected",
                    "version": "All other versions"
                  },
                  {
                    "status": "unaffected",
                    "version": "Patch version 4.9.15 and later"
                  }
                ]
              },
              {
                "product": "Fisheye Data Center",
                "vendor": "Atlassian",
                "versions": [
                  {
                    "status": "affected",
                    "version": "All other versions"
                  },
                  {
                    "status": "unaffected",
                    "version": "Patch version 4.9.15 and later"
                  }
                ]
              },
              {
                "product": "Jira Service Management Data Center",
                "vendor": "Atlassian",
                "versions": [
                  {
                    "status": "affected",
                    "version": "All other versions"
                  },
                  {
                    "status": "unaffected",
                    "version": "Patch version 11.3.12 and later"
                  },
                  {
                    "status": "unaffected",
                    "version": "Patch version 10.3.26 and later"
                  },
                  {
                    "status": "unaffected",
                    "version": "Patch version 5.12.40 and later"
                  }
                ]
              },
              {
                "product": "Jira Software Data Center",
                "vendor": "Atlassian",
                "versions": [
                  {
                    "status": "affected",
                    "version": "All other versions"
                  },
                  {
                    "status": "unaffected",
                    "version": "Patch version 11.3.12 and later"
                  },
                  {
                    "status": "unaffected",
                    "version": "Patch version 10.3.26 and later"
                  },
                  {
                    "status": "unaffected",
                    "version": "Patch version 9.12.40 and later"
                  }
                ]
              }
            ],
            "source": "security@atlassian.com"
          }
        ],
        "cisaActionDue": "2026-10-18",
        "cisaExploitAdd": "2026-10-15",
        "cisaRequiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA\u2019s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA\u2019s \u201cForensics Triage Requirements\u201d (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset\u0027s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
        "cisaVulnerabilityName": "Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability",
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:atlassian:bitbucket_data_center:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "7F95E74C-C2B5-4527-9282-A9C1E6FE2770",
                    "versionEndExcluding": "9.4.26",
                    "versionStartIncluding": "7.17.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:atlassian:bitbucket_data_center:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "4489C580-A184-45F2-945A-74919B30770E",
                    "versionEndExcluding": "10.2.8",
                    "versionStartIncluding": "9.5.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:atlassian:bitbucket_data_center:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "FC3E298E-8B85-4EE6-B5BD-B9D2ECE4ACF4",
                    "versionEndExcluding": "10.5.1",
                    "versionStartIncluding": "10.3.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:atlassian:bitbucket_server:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "6C615C3F-17A8-4458-88C1-342B973C0FB1",
                    "versionEndIncluding": "8.14.6",
                    "versionStartIncluding": "4.6.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E935B10B-F918-41C0-890D-DB9058BC503B",
                    "versionEndExcluding": "9.2.26",
                    "versionStartIncluding": "5.10.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "8ABC2EDD-401B-4065-98CA-1D6AFE8C48E7",
                    "versionEndExcluding": "10.2.19",
                    "versionStartIncluding": "9.3.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:atlassian:crowd:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "D7704951-4EDF-4ADD-BF1F-0E74302B4D15",
                    "versionEndExcluding": "6.3.7",
                    "versionStartIncluding": "2.11.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:atlassian:crowd:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "0C6C0576-C6B8-4B7B-A3AF-2F49C07CD087",
                    "versionEndExcluding": "7.0.3",
                    "versionStartIncluding": "7.0.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:atlassian:crowd:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "2DDBD17E-7209-4402-81E0-C3A77D9BADC6",
                    "versionEndExcluding": "7.1.7",
                    "versionStartIncluding": "7.1.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:atlassian:crowd:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "A00677AE-D4A9-486C-8D5B-FAC4CD68F17E",
                    "versionEndExcluding": "7.2.4",
                    "versionStartIncluding": "7.2.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "8C2734C1-0626-4C2B-8E7E-1E5744931699",
                    "versionEndExcluding": "9.12.40",
                    "versionStartIncluding": "7.1.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "13B7AADD-EE93-4BE5-A12A-FC69F024276D",
                    "versionEndExcluding": "10.3.26",
                    "versionStartIncluding": "9.13.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "585E5684-41A5-4882-BBE6-8CC388162DC6",
                    "versionEndExcluding": "11.3.12",
                    "versionStartIncluding": "10.4.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:atlassian:jira_service_desk:*:*:*:*:data_center:*:*:*",
                    "matchCriteriaId": "96833142-C39A-4BEF-B636-E013C5FBF1E7",
                    "versionEndIncluding": "4.13.27",
                    "versionStartIncluding": "3.1.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:data_center:*:*:*",
                    "matchCriteriaId": "B53D3DC2-160F-4A58-A371-AEE4A4D2EBCA",
                    "versionEndExcluding": "5.12.40",
                    "versionStartIncluding": "4.14.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:data_center:*:*:*",
                    "matchCriteriaId": "EAB2D1C1-8AF2-49EE-AD67-5B489BD4BD6A",
                    "versionEndExcluding": "10.3.26",
                    "versionStartIncluding": "5.13.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:data_center:*:*:*",
                    "matchCriteriaId": "7166EDE8-5D90-4B90-B770-0DBD581D10E9",
                    "versionEndExcluding": "11.3.12",
                    "versionStartIncluding": "10.4.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:atlassian:bamboo:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "9E8447C5-5177-4BC0-86E5-CCF9339B6C74",
                    "versionEndExcluding": "10.2.24",
                    "versionStartIncluding": "7.0.1",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:atlassian:bamboo:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "7355838B-DA4B-4399-BA98-D97CBA4F45A0",
                    "versionEndExcluding": "12.1.12",
                    "versionStartIncluding": "11.0.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:atlassian:crucible:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "157CCC63-800B-46BD-AE83-9F8C8CC481FE",
                    "versionEndExcluding": "4.9.15",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:atlassian:fisheye:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "74B7DE64-7D30-4076-983A-D9814AC90B3A",
                    "versionEndExcluding": "4.9.15",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior knowledge of the target file\u0027s exact name and path; this vulnerability does not allow attackers to enumerate or list directory contents. In some configurations, there may be some sensitive files that make this highly severe. This vulnerability allows an unauthenticated remote attacker to access specific files within the web application root directory in affected versions. The vulnerability must be addressed for affected versions of: -- Bitbucket Data Center, introduced in version \u003e= 4.6.0, fix versions: 9.4.26, 10.2.8, 10.5.1 -- Confluence Data Center, introduced in version \u003e= 5.10.0, fix versions 9.2.26, 10.2.19 -- Crowd Data Center, introduced in version \u003e= 2.11.0, fix versions 6.3.7, 7.0.3, 7.1.7, 7.2.4 -- Jira Software Data Center, introduced in version \u003e= 7.1.0, fix versions 9.12.40, 10.3.26, 11.3.12 -- Jira Service Management Data Center, introduced in version \u003e= 3.1.0, fix versions 5.12.40, 10.3.26, 11.3.12 -- Bamboo Data Center \u003e= 7.0.1, fix versions 10.2.24, 12.1.12 -- Crucible, fix versions 4.9.15 -- Fisheye, fix version 4.9.15 -- Exploitation requires prior knowledge of the target file\u0027s exact name and path. The vulnerability does not include the capability to enumerate or list directory contents."
          },
          {
            "lang": "es",
            "value": "Esta es una vulnerabilidad en Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible y Fisheye. Esta vulnerabilidad de Acceso Arbitrario a Archivos permite a un atacante no autenticado acceder a archivos espec\u00edficos dentro del directorio ra\u00edz de la aplicaci\u00f3n web en las versiones afectadas. La explotaci\u00f3n requiere conocimiento previo del nombre y la ruta exactos del archivo objetivo; esta vulnerabilidad no permite a los atacantes enumerar o listar el contenido del directorio. En algunas configuraciones, puede haber archivos sensibles que la hacen altamente severa. Esta vulnerabilidad permite a un atacante remoto no autenticado acceder a archivos espec\u00edficos dentro del directorio ra\u00edz de la aplicaci\u00f3n web en las versiones afectadas. La vulnerabilidad debe abordarse para las versiones afectadas de:\n-- Bitbucket Data Center, introducida en la versi\u00f3n 4.6.0 o posteriores, con versiones corregidas: 9.4.26, 10.2.8, 10.5.1\n-- Confluence Data Center, introducida en la versi\u00f3n 5.10.0 o posteriores, con versiones corregidas: 9.2.26, 10.2.19\n-- Crowd Data Center, introducida en la versi\u00f3n 2.11.0 o posteriores, con versiones corregidas: 6.3.7, 7.0.3, 7.1.7, 7.2.4\n-- Jira Software Data Center, introducida en la versi\u00f3n 7.1.0 o posteriores, con versiones corregidas: 9.12.40, 10.3.26, 11.3.12\n-- Jira Service Management Data Center, introducida en la versi\u00f3n 3.1.0 o posteriores, con versiones corregidas: 5.12.40, 10.3.26, 11.3.12\n-- Bamboo Data Center, versiones 7.0.1 o posteriores, con versiones corregidas: 10.2.24, 12.1.12\n-- Crucible, con versiones corregidas: 4.9.15\n-- Fisheye, con versi\u00f3n corregida: 4.9.15\n-- La explotaci\u00f3n requiere conocimiento previo del nombre y la ruta exactos del archivo objetivo. La vulnerabilidad no incluye la capacidad de enumerar o listar el contenido del directorio."
          }
        ],
        "id": "CVE-2026-21589",
        "lastModified": "2026-10-26T10:10:00.140",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 9.3,
                "baseSeverity": "CRITICAL",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "NOT_DEFINED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "HIGH",
                "subConfidentialityImpact": "HIGH",
                "subIntegrityImpact": "HIGH",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "NONE",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "security@atlassian.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-21589",
                "options": [
                  {
                    "exploitation": "active"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T00:00:00+00:00",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-10-05T22:16:58.423",
        "references": [
          {
            "source": "security@atlassian.com",
            "tags": [
              "Issue Tracking",
              "Mitigation",
              "Vendor Advisory"
            ],
            "url": "https://jira.atlassian.com/browse/BAM-26567"
          },
          {
            "source": "security@atlassian.com",
            "tags": [
              "Issue Tracking",
              "Mitigation",
              "Vendor Advisory"
            ],
            "url": "https://jira.atlassian.com/browse/BSERV-20604"
          },
          {
            "source": "security@atlassian.com",
            "tags": [
              "Issue Tracking",
              "Mitigation",
              "Vendor Advisory"
            ],
            "url": "https://jira.atlassian.com/browse/CONFSERVER-104488"
          },
          {
            "source": "security@atlassian.com",
            "tags": [
              "Issue Tracking",
              "Mitigation",
              "Vendor Advisory"
            ],
            "url": "https://jira.atlassian.com/browse/CRUC-8741"
          },
          {
            "source": "security@atlassian.com",
            "tags": [
              "Issue Tracking",
              "Mitigation",
              "Vendor Advisory"
            ],
            "url": "https://jira.atlassian.com/browse/CWD-6610"
          },
          {
            "source": "security@atlassian.com",
            "tags": [
              "Issue Tracking",
              "Mitigation",
              "Vendor Advisory"
            ],
            "url": "https://jira.atlassian.com/browse/FE-7583"
          },
          {
            "source": "security@atlassian.com",
            "tags": [
              "Issue Tracking",
              "Mitigation",
              "Vendor Advisory"
            ],
            "url": "https://jira.atlassian.com/browse/JRASERVER-79546"
          },
          {
            "source": "security@atlassian.com",
            "tags": [
              "Issue Tracking",
              "Mitigation",
              "Vendor Advisory"
            ],
            "url": "https://jira.atlassian.com/browse/JSDSERVER-16809"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://github.com/watchtowrlabs/watchTowr-vs-Atlassian-CVE-2026-21589"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "tags": [
              "US Government Resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21589"
          }
        ],
        "sourceIdentifier": "security@atlassian.com",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-552"
              }
            ],
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-21589",
                    "options": [
                      {
                        "Exploitation": "active"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-10-15T00:00:00+00:00",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              },
              {
                "other": {
                  "content": {
                    "dateAdded": "2026-10-15",
                    "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21589"
                  },
                  "type": "kev"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-10-06T13:51:25.309Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "timeline": [
              {
                "lang": "en",
                "time": "2026-10-15T00:00:00.000Z",
                "value": "CVE-2026-21589 added to CISA KEV"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "Bamboo Data Center",
              "vendor": "Atlassian",
              "versions": [
                {
                  "status": "affected",
                  "version": "All other versions"
                },
                {
                  "status": "unaffected",
                  "version": "Patch version 10.2.24 and later"
                },
                {
                  "status": "unaffected",
                  "version": "Patch version 12.1.12 and later"
                }
              ]
            },
            {
              "product": "Bitbucket Data Center",
              "vendor": "Atlassian",
              "versions": [
                {
                  "status": "affected",
                  "version": "All other versions"
                },
                {
                  "status": "unaffected",
                  "version": "Patch version 10.2.8 and later"
                },
                {
                  "status": "unaffected",
                  "version": "Patch version 10.5.1 and later"
                },
                {
                  "status": "unaffected",
                  "version": "Patch version 9.4.26 and later"
                }
              ]
            },
            {
              "product": "Confluence Data Center",
              "vendor": "Atlassian",
              "versions": [
                {
                  "status": "affected",
                  "version": "All other versions"
                },
                {
                  "status": "unaffected",
                  "version": "Patch version 10.2.19 and later"
                },
                {
                  "status": "unaffected",
                  "version": "Patch version 9.2.26 and later"
                }
              ]
            },
            {
              "product": "Crowd Data Center",
              "vendor": "Atlassian",
              "versions": [
                {
                  "status": "affected",
                  "version": "All other versions"
                },
                {
                  "status": "unaffected",
                  "version": "Patch version 7.2.4 and later"
                },
                {
                  "status": "unaffected",
                  "version": "Patch version 7.1.7 and later"
                },
                {
                  "status": "unaffected",
                  "version": "Patch version 7.0.3 and later"
                },
                {
                  "status": "unaffected",
                  "version": "Patch version 6.3.7 and later"
                }
              ]
            },
            {
              "product": "Crucible Data Center",
              "vendor": "Atlassian",
              "versions": [
                {
                  "status": "affected",
                  "version": "All other versions"
                },
                {
                  "status": "unaffected",
                  "version": "Patch version 4.9.15 and later"
                }
              ]
            },
            {
              "product": "Fisheye Data Center",
              "vendor": "Atlassian",
              "versions": [
                {
                  "status": "affected",
                  "version": "All other versions"
                },
                {
                  "status": "unaffected",
                  "version": "Patch version 4.9.15 and later"
                }
              ]
            },
            {
              "product": "Jira Service Management Data Center",
              "vendor": "Atlassian",
              "versions": [
                {
                  "status": "affected",
                  "version": "All other versions"
                },
                {
                  "status": "unaffected",
                  "version": "Patch version 11.3.12 and later"
                },
                {
                  "status": "unaffected",
                  "version": "Patch version 10.3.26 and later"
                },
                {
                  "status": "unaffected",
                  "version": "Patch version 5.12.40 and later"
                }
              ]
            },
            {
              "product": "Jira Software Data Center",
              "vendor": "Atlassian",
              "versions": [
                {
                  "status": "affected",
                  "version": "All other versions"
                },
                {
                  "status": "unaffected",
                  "version": "Patch version 11.3.12 and later"
                },
                {
                  "status": "unaffected",
                  "version": "Patch version 10.3.26 and later"
                },
                {
                  "status": "unaffected",
                  "version": "Patch version 9.12.40 and later"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior knowledge of the target file\u0027s exact name and path; this vulnerability does not allow attackers to enumerate or list directory contents. In some configurations, there may be some sensitive files that make this highly severe. This vulnerability allows an unauthenticated remote attacker to access specific files within the web application root directory in affected versions. The vulnerability must be addressed for affected versions of: -- Bitbucket Data Center, introduced in version \u003e= 4.6.0, fix versions: 9.4.26, 10.2.8, 10.5.1 -- Confluence Data Center, introduced in version \u003e= 5.10.0, fix versions 9.2.26, 10.2.19 -- Crowd Data Center, introduced in version \u003e= 2.11.0, fix versions 6.3.7, 7.0.3, 7.1.7, 7.2.4 -- Jira Software Data Center, introduced in version \u003e= 7.1.0, fix versions 9.12.40, 10.3.26, 11.3.12 -- Jira Service Management Data Center, introduced in version \u003e= 3.1.0, fix versions 5.12.40, 10.3.26, 11.3.12 -- Bamboo Data Center \u003e= 7.0.1, fix versions 10.2.24, 12.1.12 -- Crucible, fix versions 4.9.15 -- Fisheye, fix version 4.9.15 -- Exploitation requires prior knowledge of the target file\u0027s exact name and path. The vulnerability does not include the capability to enumerate or list directory contents."
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "baseScore": 9.3,
                "baseSeverity": "CRITICAL",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H",
                "version": "4.0"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "description": "Path Traversal (Arbitrary Read/Write)",
                  "lang": "en",
                  "type": "Path Traversal (Arbitrary Read/Write)"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-10-19T18:26:40.891Z",
            "orgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66",
            "shortName": "atlassian"
          },
          "references": [
            {
              "url": "https://jira.atlassian.com/browse/BAM-26567"
            },
            {
              "url": "https://jira.atlassian.com/browse/BSERV-20604"
            },
            {
              "url": "https://jira.atlassian.com/browse/CONFSERVER-104488"
            },
            {
              "url": "https://jira.atlassian.com/browse/CRUC-8741"
            },
            {
              "url": "https://jira.atlassian.com/browse/CWD-6610"
            },
            {
              "url": "https://jira.atlassian.com/browse/FE-7583"
            },
            {
              "url": "https://jira.atlassian.com/browse/JRASERVER-79546"
            },
            {
              "url": "https://jira.atlassian.com/browse/JSDSERVER-16809"
            }
          ]
        }
      },
      "cveMetadata": {
        "assignerOrgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66",
        "assignerShortName": "atlassian",
        "cveId": "CVE-2026-21589",
        "datePublished": "2026-10-05T21:30:00.390Z",
        "dateReserved": "2026-01-01T00:00:40.722Z",
        "dateUpdated": "2026-10-19T18:26:40.891Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

BDU:2026-16016 (CVE-2026-21589)

Vulnerability from fstec – Published: 2026-10-07 – Updated: 2026-10-16 – View on bdu.fstec.ru Exploit publicly available Yes Fixed

CISA Shadowserver Previdian

Title

Уязвимость программных продуктов Atlassian Data Center, связанная с использованием файлов и каталогов, доступных внешним сторонам, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации

Summary

Уязвимость программных продуктов Atlassian Data Center связана с использованием файлов и каталогов, доступных внешним сторонам. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, получить несанкционированный доступ к защищаемой информации

Severity

7.8 (High) CVSS 2.0


                      
                        AV:N/AC:L/Au:N/C:C/I:N/A:N

7.5 (High) CVSS 3.1


                      
                        CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

9.3 (Critical) CVSS 4.0


                      
                        CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H

Class

Architecture vulnerability

Status

Confirmed by the vendor

Exploitation

Information gathering

Incidents

Yes

Remediation

Software update

CWE

CWE-552 - Файлы и каталоги, доступные внешним сторонам

Aliases

CVE-2026-21589

References

10 references

URL
https://github.com/tc4dy/CVE-2026-21589-PoC-Exploit
https://jira.atlassian.com/browse/BAM-26567
https://jira.atlassian.com/browse/BSERV-20604
https://jira.atlassian.com/browse/CONFSERVER-104488
https://jira.atlassian.com/browse/CRUC-8741
https://jira.atlassian.com/browse/CWD-6610
https://jira.atlassian.com/browse/FE-7583
https://jira.atlassian.com/browse/JRASERVER-79546
https://jira.atlassian.com/browse/JSDSERVER-16809
https://www.cisa.gov/sites/default/files/csv/known_exploited_vulnerabilities.csv

Impacted products

8 products from 1 vendor

Vendors

Atlassian

Products

Bamboo Data Center, Bitbucket Data Center, Confluence Data Center, Crowd Data Center, Crucible Data Center, Fisheye Data Center, Jira Service Management Data Center, Jira Software Data Center

Versions

до 10.2.24 (Bamboo Data Center), до 12.1.12 (Bamboo Data Center), до 10.2.8 (Bitbucket Data Center), до 10.5.1 (Bitbucket Data Center), до 9.4.26 (Bitbucket Data Center), до 10.2.19 (Confluence Data Center), до 9.2.26 (Confluence Data Center), до 7.2.4 (Crowd Data Center), до 7.1.7 (Crowd Data Center), до 7.0.3 (Crowd Data Center), до 6.3.7 (Crowd Data Center), до 4.9.15 (Crucible Data Center), до 4.9.15 (Fisheye Data Center), до 11.3.12 (Jira Service Management Data Center), до 10.3.26 (Jira Service Management Data Center), до 5.12.40 (Jira Service Management Data Center), до 11.3.12 (Jira Software Data Center), до 10.3.26 (Jira Software Data Center), до 9.12.40 (Jira Software Data Center)

Product types

Application software, Appliance software

Mitigations

Использование рекомендаций производителя: https://jira.atlassian.com/browse/BAM-26567 https://jira.atlassian.com/browse/BSERV-20604 https://jira.atlassian.com/browse/CONFSERVER-104488 https://jira.atlassian.com/browse/CRUC-8741 https://jira.atlassian.com/browse/CWD-6610 https://jira.atlassian.com/browse/FE-7583 https://jira.atlassian.com/browse/JRASERVER-79546 https://jira.atlassian.com/browse/JSDSERVER-16809

JSON

To clipboard

{
  "CVSS 2.0": "AV:N/AC:L/Au:N/C:C/I:N/A:N",
  "CVSS 3.0": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
  "CVSS 4.0": "AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H",
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "Atlassian",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "\u0434\u043e 10.2.24 (Bamboo Data Center), \u0434\u043e 12.1.12 (Bamboo Data Center), \u0434\u043e 10.2.8 (Bitbucket Data Center), \u0434\u043e 10.5.1 (Bitbucket Data Center), \u0434\u043e 9.4.26 (Bitbucket Data Center), \u0434\u043e 10.2.19 (Confluence Data Center), \u0434\u043e 9.2.26 (Confluence Data Center), \u0434\u043e 7.2.4 (Crowd Data Center), \u0434\u043e 7.1.7 (Crowd Data Center), \u0434\u043e 7.0.3 (Crowd Data Center), \u0434\u043e 6.3.7 (Crowd Data Center), \u0434\u043e 4.9.15 (Crucible Data Center), \u0434\u043e 4.9.15 (Fisheye Data Center), \u0434\u043e 11.3.12 (Jira Service Management Data Center), \u0434\u043e 10.3.26 (Jira Service Management Data Center), \u0434\u043e 5.12.40 (Jira Service Management Data Center), \u0434\u043e 11.3.12 (Jira Software Data Center), \u0434\u043e 10.3.26 (Jira Software Data Center), \u0434\u043e 9.12.40 (Jira Software Data Center)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f:\nhttps://jira.atlassian.com/browse/BAM-26567\nhttps://jira.atlassian.com/browse/BSERV-20604\nhttps://jira.atlassian.com/browse/CONFSERVER-104488\nhttps://jira.atlassian.com/browse/CRUC-8741\nhttps://jira.atlassian.com/browse/CWD-6610\nhttps://jira.atlassian.com/browse/FE-7583\nhttps://jira.atlassian.com/browse/JRASERVER-79546\nhttps://jira.atlassian.com/browse/JSDSERVER-16809",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "02.10.2026",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "16.10.2026",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "07.10.2026",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2026-16016",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2026-21589",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u044b",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "Bamboo Data Center, Bitbucket Data Center, Confluence Data Center, Crowd Data Center, Crucible Data Center, Fisheye Data Center, Jira Service Management Data Center, Jira Software Data Center",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": null,
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u0445 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432 Atlassian Data Center, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0430\u044f \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0444\u0430\u0439\u043b\u043e\u0432 \u0438 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u043e\u0432, \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0445 \u0432\u043d\u0435\u0448\u043d\u0438\u043c \u0441\u0442\u043e\u0440\u043e\u043d\u0430\u043c, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043d\u0435\u0441\u0430\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0421\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u0435",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u0424\u0430\u0439\u043b\u044b \u0438 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0438, \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0435 \u0432\u043d\u0435\u0448\u043d\u0438\u043c \u0441\u0442\u043e\u0440\u043e\u043d\u0430\u043c (CWE-552)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u0445 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432 Atlassian Data Center \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0444\u0430\u0439\u043b\u043e\u0432 \u0438 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u043e\u0432, \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0445 \u0432\u043d\u0435\u0448\u043d\u0438\u043c \u0441\u0442\u043e\u0440\u043e\u043d\u0430\u043c. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e, \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043d\u0435\u0441\u0430\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041d\u0435\u0441\u0430\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0441\u0431\u043e\u0440 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://github.com/tc4dy/CVE-2026-21589-PoC-Exploit\nhttps://jira.atlassian.com/browse/BAM-26567\nhttps://jira.atlassian.com/browse/BSERV-20604\nhttps://jira.atlassian.com/browse/CONFSERVER-104488\nhttps://jira.atlassian.com/browse/CRUC-8741\nhttps://jira.atlassian.com/browse/CWD-6610\nhttps://jira.atlassian.com/browse/FE-7583\nhttps://jira.atlassian.com/browse/JRASERVER-79546\nhttps://jira.atlassian.com/browse/JSDSERVER-16809\nhttps://www.cisa.gov/sites/default/files/csv/known_exploited_vulnerabilities.csv",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u041f\u0440\u0438\u043a\u043b\u0430\u0434\u043d\u043e\u0435 \u041f\u041e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c, \u041f\u041e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e-\u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0433\u043e \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-552",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 7,8)\n\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.1 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 7,5)\n\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u043e\u0446\u0435\u043d\u043a\u0430 CVSS 4.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 9,3)"
}

CERTFR-2026-AVI-1264

Vulnerability from certfr_avis - Published: 2026-10-06 - Updated: 2026-10-07

Unevulnérabilité a été découverte dans les produits Atlassian. Elle permet à un attaquant de provoquer une atteinte à la confidentialité des données.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
Atlassian	N/A	Crucible versions antérieures à 4.9.15
Atlassian	N/A	Bamboo Data Center versions 12.1.x antérieures à 12.1.12
Atlassian	Jira	Jira Software Data Center versions 11.3.x antérieures à 11.3.12
Atlassian	Jira	Jira Software Data Center versions 10.3.x antérieures à 10.3.26
Atlassian	N/A	Crowd Data Center versions 7.2.x antérieures à 7.2.4
Atlassian	Confluence	Confluence Data Center versions 10.2.x antérieures à 10.2.19
Atlassian	N/A	Crowd Data Center versions 7.0x antérieures à 7.0.3
Atlassian	N/A	Bamboo Data Center versions antérieures à 10.2.24
Atlassian	N/A	Bitbucket Data Center versions 10.2.x antérieures à 10.2.8
Atlassian	Jira	Jira Software Data Center versions antérieures à 9.12.40
Atlassian	N/A	Crowd Data Center versions antérieures à 6.3.7
Atlassian	Confluence	Confluence Data Center versions antérieures à 9.2.26
Atlassian	N/A	Crowd Data Center versions 7.1.x antérieures à 7.1.7
Atlassian	N/A	Fisheye versions antérieures à 4.9.15
Atlassian	N/A	Bitbucket Data Center versions antérieures à 9.4.26
Atlassian	N/A	Bitbucket Data Center versions 10.5.x antérieures à 10.5.1

References

Title

Publication Time

FKIE_CVE-2026-21589

Vulnerability from fkie_nvd - Published: 2026-10-05 22:16 - Updated: 2026-10-26 10:10

CISA Shadowserver Previdian

Severity

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Summary

References

URL	Tags
security@atlassian.com	https://jira.atlassian.com/browse/BAM-26567	Issue Tracking, Mitigation, Vendor Advisory
security@atlassian.com	https://jira.atlassian.com/browse/BSERV-20604	Issue Tracking, Mitigation, Vendor Advisory
security@atlassian.com	https://jira.atlassian.com/browse/CONFSERVER-104488	Issue Tracking, Mitigation, Vendor Advisory
security@atlassian.com	https://jira.atlassian.com/browse/CRUC-8741	Issue Tracking, Mitigation, Vendor Advisory
security@atlassian.com	https://jira.atlassian.com/browse/CWD-6610	Issue Tracking, Mitigation, Vendor Advisory
security@atlassian.com	https://jira.atlassian.com/browse/FE-7583	Issue Tracking, Mitigation, Vendor Advisory
security@atlassian.com	https://jira.atlassian.com/browse/JRASERVER-79546	Issue Tracking, Mitigation, Vendor Advisory
security@atlassian.com	https://jira.atlassian.com/browse/JSDSERVER-16809	Issue Tracking, Mitigation, Vendor Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/watchtowrlabs/watchTowr-vs-Atlassian-CVE-2026-21589	Third Party Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0	https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21589	US Government Resource

Impacted products

Vendor	Product	Version
atlassian	bitbucket_data_center	*
atlassian	bitbucket_data_center	*
atlassian	bitbucket_data_center	*
atlassian	bitbucket_server	*
atlassian	confluence_data_center	*
atlassian	confluence_data_center	*
atlassian	crowd	*
atlassian	crowd	*
atlassian	crowd	*
atlassian	crowd	*
atlassian	jira_data_center	*
atlassian	jira_data_center	*
atlassian	jira_data_center	*
atlassian	jira_service_desk	*
atlassian	jira_service_management	*
atlassian	jira_service_management	*
atlassian	jira_service_management	*
atlassian	bamboo	*
atlassian	bamboo	*
atlassian	crucible	*
atlassian	fisheye	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "Bamboo Data Center",
          "vendor": "Atlassian",
          "versions": [
            {
              "status": "affected",
              "version": "All other versions"
            },
            {
              "status": "unaffected",
              "version": "Patch version 10.2.24 and later"
            },
            {
              "status": "unaffected",
              "version": "Patch version 12.1.12 and later"
            }
          ]
        },
        {
          "product": "Bitbucket Data Center",
          "vendor": "Atlassian",
          "versions": [
            {
              "status": "affected",
              "version": "All other versions"
            },
            {
              "status": "unaffected",
              "version": "Patch version 10.2.8 and later"
            },
            {
              "status": "unaffected",
              "version": "Patch version 10.5.1 and later"
            },
            {
              "status": "unaffected",
              "version": "Patch version 9.4.26 and later"
            }
          ]
        },
        {
          "product": "Confluence Data Center",
          "vendor": "Atlassian",
          "versions": [
            {
              "status": "affected",
              "version": "All other versions"
            },
            {
              "status": "unaffected",
              "version": "Patch version 10.2.19 and later"
            },
            {
              "status": "unaffected",
              "version": "Patch version 9.2.26 and later"
            }
          ]
        },
        {
          "product": "Crowd Data Center",
          "vendor": "Atlassian",
          "versions": [
            {
              "status": "affected",
              "version": "All other versions"
            },
            {
              "status": "unaffected",
              "version": "Patch version 7.2.4 and later"
            },
            {
              "status": "unaffected",
              "version": "Patch version 7.1.7 and later"
            },
            {
              "status": "unaffected",
              "version": "Patch version 7.0.3 and later"
            },
            {
              "status": "unaffected",
              "version": "Patch version 6.3.7 and later"
            }
          ]
        },
        {
          "product": "Crucible Data Center",
          "vendor": "Atlassian",
          "versions": [
            {
              "status": "affected",
              "version": "All other versions"
            },
            {
              "status": "unaffected",
              "version": "Patch version 4.9.15 and later"
            }
          ]
        },
        {
          "product": "Fisheye Data Center",
          "vendor": "Atlassian",
          "versions": [
            {
              "status": "affected",
              "version": "All other versions"
            },
            {
              "status": "unaffected",
              "version": "Patch version 4.9.15 and later"
            }
          ]
        },
        {
          "product": "Jira Service Management Data Center",
          "vendor": "Atlassian",
          "versions": [
            {
              "status": "affected",
              "version": "All other versions"
            },
            {
              "status": "unaffected",
              "version": "Patch version 11.3.12 and later"
            },
            {
              "status": "unaffected",
              "version": "Patch version 10.3.26 and later"
            },
            {
              "status": "unaffected",
              "version": "Patch version 5.12.40 and later"
            }
          ]
        },
        {
          "product": "Jira Software Data Center",
          "vendor": "Atlassian",
          "versions": [
            {
              "status": "affected",
              "version": "All other versions"
            },
            {
              "status": "unaffected",
              "version": "Patch version 11.3.12 and later"
            },
            {
              "status": "unaffected",
              "version": "Patch version 10.3.26 and later"
            },
            {
              "status": "unaffected",
              "version": "Patch version 9.12.40 and later"
            }
          ]
        }
      ],
      "source": "security@atlassian.com"
    }
  ],
  "cisaActionDue": "2026-10-18",
  "cisaExploitAdd": "2026-10-15",
  "cisaRequiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA\u2019s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA\u2019s \u201cForensics Triage Requirements\u201d (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset\u0027s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
  "cisaVulnerabilityName": "Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability",
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:atlassian:bitbucket_data_center:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "7F95E74C-C2B5-4527-9282-A9C1E6FE2770",
              "versionEndExcluding": "9.4.26",
              "versionStartIncluding": "7.17.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:atlassian:bitbucket_data_center:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "4489C580-A184-45F2-945A-74919B30770E",
              "versionEndExcluding": "10.2.8",
              "versionStartIncluding": "9.5.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:atlassian:bitbucket_data_center:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "FC3E298E-8B85-4EE6-B5BD-B9D2ECE4ACF4",
              "versionEndExcluding": "10.5.1",
              "versionStartIncluding": "10.3.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:atlassian:bitbucket_server:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "6C615C3F-17A8-4458-88C1-342B973C0FB1",
              "versionEndIncluding": "8.14.6",
              "versionStartIncluding": "4.6.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "E935B10B-F918-41C0-890D-DB9058BC503B",
              "versionEndExcluding": "9.2.26",
              "versionStartIncluding": "5.10.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "8ABC2EDD-401B-4065-98CA-1D6AFE8C48E7",
              "versionEndExcluding": "10.2.19",
              "versionStartIncluding": "9.3.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:atlassian:crowd:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "D7704951-4EDF-4ADD-BF1F-0E74302B4D15",
              "versionEndExcluding": "6.3.7",
              "versionStartIncluding": "2.11.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:atlassian:crowd:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "0C6C0576-C6B8-4B7B-A3AF-2F49C07CD087",
              "versionEndExcluding": "7.0.3",
              "versionStartIncluding": "7.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:atlassian:crowd:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "2DDBD17E-7209-4402-81E0-C3A77D9BADC6",
              "versionEndExcluding": "7.1.7",
              "versionStartIncluding": "7.1.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:atlassian:crowd:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "A00677AE-D4A9-486C-8D5B-FAC4CD68F17E",
              "versionEndExcluding": "7.2.4",
              "versionStartIncluding": "7.2.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "8C2734C1-0626-4C2B-8E7E-1E5744931699",
              "versionEndExcluding": "9.12.40",
              "versionStartIncluding": "7.1.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "13B7AADD-EE93-4BE5-A12A-FC69F024276D",
              "versionEndExcluding": "10.3.26",
              "versionStartIncluding": "9.13.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "585E5684-41A5-4882-BBE6-8CC388162DC6",
              "versionEndExcluding": "11.3.12",
              "versionStartIncluding": "10.4.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:atlassian:jira_service_desk:*:*:*:*:data_center:*:*:*",
              "matchCriteriaId": "96833142-C39A-4BEF-B636-E013C5FBF1E7",
              "versionEndIncluding": "4.13.27",
              "versionStartIncluding": "3.1.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:data_center:*:*:*",
              "matchCriteriaId": "B53D3DC2-160F-4A58-A371-AEE4A4D2EBCA",
              "versionEndExcluding": "5.12.40",
              "versionStartIncluding": "4.14.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:data_center:*:*:*",
              "matchCriteriaId": "EAB2D1C1-8AF2-49EE-AD67-5B489BD4BD6A",
              "versionEndExcluding": "10.3.26",
              "versionStartIncluding": "5.13.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:data_center:*:*:*",
              "matchCriteriaId": "7166EDE8-5D90-4B90-B770-0DBD581D10E9",
              "versionEndExcluding": "11.3.12",
              "versionStartIncluding": "10.4.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:atlassian:bamboo:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "9E8447C5-5177-4BC0-86E5-CCF9339B6C74",
              "versionEndExcluding": "10.2.24",
              "versionStartIncluding": "7.0.1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:atlassian:bamboo:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "7355838B-DA4B-4399-BA98-D97CBA4F45A0",
              "versionEndExcluding": "12.1.12",
              "versionStartIncluding": "11.0.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:atlassian:crucible:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "157CCC63-800B-46BD-AE83-9F8C8CC481FE",
              "versionEndExcluding": "4.9.15",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:atlassian:fisheye:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "74B7DE64-7D30-4076-983A-D9814AC90B3A",
              "versionEndExcluding": "4.9.15",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior knowledge of the target file\u0027s exact name and path; this vulnerability does not allow attackers to enumerate or list directory contents. In some configurations, there may be some sensitive files that make this highly severe. This vulnerability allows an unauthenticated remote attacker to access specific files within the web application root directory in affected versions. The vulnerability must be addressed for affected versions of: -- Bitbucket Data Center, introduced in version \u003e= 4.6.0, fix versions: 9.4.26, 10.2.8, 10.5.1 -- Confluence Data Center, introduced in version \u003e= 5.10.0, fix versions 9.2.26, 10.2.19 -- Crowd Data Center, introduced in version \u003e= 2.11.0, fix versions 6.3.7, 7.0.3, 7.1.7, 7.2.4 -- Jira Software Data Center, introduced in version \u003e= 7.1.0, fix versions 9.12.40, 10.3.26, 11.3.12 -- Jira Service Management Data Center, introduced in version \u003e= 3.1.0, fix versions 5.12.40, 10.3.26, 11.3.12 -- Bamboo Data Center \u003e= 7.0.1, fix versions 10.2.24, 12.1.12 -- Crucible, fix versions 4.9.15 -- Fisheye, fix version 4.9.15 -- Exploitation requires prior knowledge of the target file\u0027s exact name and path. The vulnerability does not include the capability to enumerate or list directory contents."
    },
    {
      "lang": "es",
      "value": "Esta es una vulnerabilidad en Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible y Fisheye. Esta vulnerabilidad de Acceso Arbitrario a Archivos permite a un atacante no autenticado acceder a archivos espec\u00edficos dentro del directorio ra\u00edz de la aplicaci\u00f3n web en las versiones afectadas. La explotaci\u00f3n requiere conocimiento previo del nombre y la ruta exactos del archivo objetivo; esta vulnerabilidad no permite a los atacantes enumerar o listar el contenido del directorio. En algunas configuraciones, puede haber archivos sensibles que la hacen altamente severa. Esta vulnerabilidad permite a un atacante remoto no autenticado acceder a archivos espec\u00edficos dentro del directorio ra\u00edz de la aplicaci\u00f3n web en las versiones afectadas. La vulnerabilidad debe abordarse para las versiones afectadas de:\n-- Bitbucket Data Center, introducida en la versi\u00f3n 4.6.0 o posteriores, con versiones corregidas: 9.4.26, 10.2.8, 10.5.1\n-- Confluence Data Center, introducida en la versi\u00f3n 5.10.0 o posteriores, con versiones corregidas: 9.2.26, 10.2.19\n-- Crowd Data Center, introducida en la versi\u00f3n 2.11.0 o posteriores, con versiones corregidas: 6.3.7, 7.0.3, 7.1.7, 7.2.4\n-- Jira Software Data Center, introducida en la versi\u00f3n 7.1.0 o posteriores, con versiones corregidas: 9.12.40, 10.3.26, 11.3.12\n-- Jira Service Management Data Center, introducida en la versi\u00f3n 3.1.0 o posteriores, con versiones corregidas: 5.12.40, 10.3.26, 11.3.12\n-- Bamboo Data Center, versiones 7.0.1 o posteriores, con versiones corregidas: 10.2.24, 12.1.12\n-- Crucible, con versiones corregidas: 4.9.15\n-- Fisheye, con versi\u00f3n corregida: 4.9.15\n-- La explotaci\u00f3n requiere conocimiento previo del nombre y la ruta exactos del archivo objetivo. La vulnerabilidad no incluye la capacidad de enumerar o listar el contenido del directorio."
    }
  ],
  "id": "CVE-2026-21589",
  "lastModified": "2026-10-26T10:10:00.140",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 9.3,
          "baseSeverity": "CRITICAL",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "HIGH",
          "subConfidentialityImpact": "HIGH",
          "subIntegrityImpact": "HIGH",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "NONE",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "security@atlassian.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-21589",
          "options": [
            {
              "exploitation": "active"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-10-15T00:00:00+00:00",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-10-05T22:16:58.423",
  "references": [
    {
      "source": "security@atlassian.com",
      "tags": [
        "Issue Tracking",
        "Mitigation",
        "Vendor Advisory"
      ],
      "url": "https://jira.atlassian.com/browse/BAM-26567"
    },
    {
      "source": "security@atlassian.com",
      "tags": [
        "Issue Tracking",
        "Mitigation",
        "Vendor Advisory"
      ],
      "url": "https://jira.atlassian.com/browse/BSERV-20604"
    },
    {
      "source": "security@atlassian.com",
      "tags": [
        "Issue Tracking",
        "Mitigation",
        "Vendor Advisory"
      ],
      "url": "https://jira.atlassian.com/browse/CONFSERVER-104488"
    },
    {
      "source": "security@atlassian.com",
      "tags": [
        "Issue Tracking",
        "Mitigation",
        "Vendor Advisory"
      ],
      "url": "https://jira.atlassian.com/browse/CRUC-8741"
    },
    {
      "source": "security@atlassian.com",
      "tags": [
        "Issue Tracking",
        "Mitigation",
        "Vendor Advisory"
      ],
      "url": "https://jira.atlassian.com/browse/CWD-6610"
    },
    {
      "source": "security@atlassian.com",
      "tags": [
        "Issue Tracking",
        "Mitigation",
        "Vendor Advisory"
      ],
      "url": "https://jira.atlassian.com/browse/FE-7583"
    },
    {
      "source": "security@atlassian.com",
      "tags": [
        "Issue Tracking",
        "Mitigation",
        "Vendor Advisory"
      ],
      "url": "https://jira.atlassian.com/browse/JRASERVER-79546"
    },
    {
      "source": "security@atlassian.com",
      "tags": [
        "Issue Tracking",
        "Mitigation",
        "Vendor Advisory"
      ],
      "url": "https://jira.atlassian.com/browse/JSDSERVER-16809"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://github.com/watchtowrlabs/watchTowr-vs-Atlassian-CVE-2026-21589"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "US Government Resource"
      ],
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21589"
    }
  ],
  "sourceIdentifier": "security@atlassian.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-552"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}

GHSA-GR66-X5PQ-8G2G

Vulnerability from github – Published: 2026-10-06 00:32 – Updated: 2026-10-19 21:35

Details

h3. Summary

h3. Context

This vulnerability allows an unauthenticated remote attacker to access specific files within the web application root directory in affected versions.

h3. Details:

The vulnerability must be addressed for affected versions of: Bitbucket Data Center, introduced in version >= 4.6.0, fix versions: 9.4.26, 10.2.8, 10.5.1 Confluence Data Center, introduced in version >= 5.10.0, fix versions 9.2.26, 10.2.19 Crowd Data Center, introduced in version >= 2.11.0, fix versions 6.3.7, 7.0.3, 7.1.1, 7.2.4 Jira Software Data Center, introduced in version >= 7.1.0, fix versions 9.12.40, 10.3.26, 11.3.12 Jira Service Management Data Center, introduced in version >= 3.1.0, fix versions 5.12.40, 10.3.26, 11.3.12 Bamboo Data Center >= 7.0.1, fix versions 10.2.24, 12.1.12 Crucible, fix versions 4.9.15 Fisheye, fix version 4.9.15
Exploitation requires prior knowledge of the target file's exact name and path.
The vulnerability does not include the capability to enumerate or list directory contents.

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

9.3 (Critical)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-21589"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-552"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-10-05T22:16:58Z",
    "severity": "CRITICAL"
  },
  "details": "h3. Summary\n\nThis is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior knowledge of the target file\u0027s exact name and path; this vulnerability does not allow attackers to enumerate or list directory contents.\u00a0In some configurations, there may be some sensitive files that make this highly severe.\u00a0\u00a0\n\nh3. Context\n\nThis vulnerability allows an unauthenticated remote attacker to access specific files within the web application root directory in affected versions.\n\nh3. Details:\n\n* The vulnerability must be addressed for affected versions of:\n Bitbucket Data Center, introduced in version \u003e= 4.6.0, fix versions: 9.4.26, 10.2.8, 10.5.1\n Confluence Data Center, introduced in version \u003e= 5.10.0, fix versions 9.2.26, 10.2.19\n Crowd Data Center, introduced in version \u003e= 2.11.0, fix versions 6.3.7, 7.0.3, 7.1.1, 7.2.4\n Jira Software Data Center, introduced in version \u003e= 7.1.0, fix versions 9.12.40, 10.3.26, 11.3.12\n Jira Service Management Data Center, introduced in version \u003e= 3.1.0, fix versions 5.12.40, 10.3.26, 11.3.12\n Bamboo Data Center \u003e= 7.0.1, fix versions 10.2.24, 12.1.12\n Crucible, fix versions 4.9.15\n Fisheye, fix version 4.9.15\n* Exploitation requires prior knowledge of the target file\u0027s exact name and path.\n* The vulnerability does not include the capability to enumerate or list directory contents.",
  "id": "GHSA-gr66-x5pq-8g2g",
  "modified": "2026-10-19T21:35:53Z",
  "published": "2026-10-06T00:32:50Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21589"
    },
    {
      "type": "WEB",
      "url": "https://github.com/watchtowrlabs/watchTowr-vs-Atlassian-CVE-2026-21589"
    },
    {
      "type": "WEB",
      "url": "https://jira.atlassian.com/browse/BAM-26567"
    },
    {
      "type": "WEB",
      "url": "https://jira.atlassian.com/browse/BSERV-20604"
    },
    {
      "type": "WEB",
      "url": "https://jira.atlassian.com/browse/CONFSERVER-104488"
    },
    {
      "type": "WEB",
      "url": "https://jira.atlassian.com/browse/CRUC-8741"
    },
    {
      "type": "WEB",
      "url": "https://jira.atlassian.com/browse/CWD-6610"
    },
    {
      "type": "WEB",
      "url": "https://jira.atlassian.com/browse/FE-7583"
    },
    {
      "type": "WEB",
      "url": "https://jira.atlassian.com/browse/JRASERVER-79546"
    },
    {
      "type": "WEB",
      "url": "https://jira.atlassian.com/browse/JSDSERVER-16809"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21589"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

NCSC-2026-0402

Vulnerability from csaf_ncscnl - Published: 2026-10-06 16:47 - Updated: 2026-10-06 16:47

Summary

Kwetsbaarheid verholpen in Atlassian Data Center producten

Scope

1 vulnerability in this advisory, including CVE-2026-21589.

CVE-2026-21589

An Arbitrary File Access vulnerability in multiple Atlassian Data Center products allows unauthenticated attackers with knowledge of file names and paths to access specific files within the web application root directory, with patches available.

Known affected: 7 products

Open the full advisory

WID-SEC-W-2026-3755

Vulnerability from csaf_certbund - Published: 2026-10-05 22:00 - Updated: 2026-10-06 22:00

Summary

Atlassian Produkte (Bamboo, Bitbucket, Confluence, Crucible, Fisheye und Jira): Schwachstelle ermöglicht Offenlegung von Informationen

Severity

Hoch

Scope

1 vulnerability in this advisory, including CVE-2026-21589.

CVE-2026-21589

Known affected: 15 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-21589 (GCVE-0-2026-21589)

CISA

Known Exploited Vulnerability - GCVE BCP-07 Compliant

Timestamps

Scope

Evidence

Vendor Report Successful Exploitation Confidence: 80% Source: cisa-kev

Details

References

Shadowserver

Known Exploited Vulnerability - GCVE BCP-07 Compliant

Characteristics

Timestamps

Scope

Evidence

Honeypot In The Wild Attempts Confidence: 70% Source: shadowserver

Details

References

Previdian

Known Exploited Vulnerability - GCVE BCP-07 Compliant

Timestamps

Scope

Evidence

Public Report Successful Exploitation Confidence: 70% Source: previdian

Details

References

BDU:2026-16016 (CVE-2026-21589)

CERTFR-2026-AVI-1264

Solutions

FKIE_CVE-2026-21589

GHSA-GR66-X5PQ-8G2G

NCSC-2026-0402

WID-SEC-W-2026-3755

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour